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DETAILED ACTION 

1 . Claims 1 -26 are presented for examination. 



Claim Rejections - 35 USC § 112 

2. The following is a quotation of the second paragraph of 35 U.S.C. 1 12: 

The specification shall conclude with one or more claims particularly pointing out and distinctly 
claiming the subject matter which the applicant regards as his invention. 

Claim 1 recites the limitation "transmitting via a computer network to said 
problem management at least one element failed message server" in claim 1 lines 18- 
19. There is insufficient antecedent basis for this limitation in the claim. For purpose of 
examination, Examiner assumes Applicant means "transmitting via a computer network 
to said problem management server at least one element failed message". 



Claim Rejections - 35 USC § 103 

3, The following is a quotation of 35 U.S.C. 103(a) which forms the basis for 

all obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed 
or described as set forth in section 1 02 of this title, if the differences between the 
subject matter sought to be patented and the prior art are such that the subject 
matter as a whole would have beien obvious at the time the invention was made 
to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was 
made. 



4. Claims 1-5, 9-10 rejected under 35 U.S.C. § 103 (a) as being 
unpatentable over Walker et al., (hereinafter Walker) U.S. Patent No. 6,061,723. 



Application/Control Number: 09/497,572 



Art Unit: 2155 



Page 3 



5. As to claim 1 , Walker teaches the invention substantially as claimed, 
including a method of producing failure alerts in a computer network containing a 
plurality of networked elements including at least one network router, at least one 
network management server, and at least one problem management server, said router 
being interconnected to several subnetworks, each subnetwork interconnecting several 
networked elements, said method comprising the steps of: 

monitoring transmissions via a computer network at least one status query 
message to each of said networked elements in said computer network (figurel, 
abstract, col. 1 lines 52-67. col. 2 lines 24-48); 

.performing a fault tree analysis to determine the most likely single point of failure 
based upon a rule structure related to the topology of the computer network, said 
performance of fault tree analysis being invoked by expiration of the timer if less than all 
status responses are received (col. 2 lines 36-col. 3 lines 31, col. 3 lines 45-col. 4 lines 
58, col. 5 lines 35-63, col. 6 lines 22-col. 7 lines 67); and 

transmitting via a computer network to said problem management (manager host 
N 1 10/network administrator read as problem management server) at least one element 
failed message server for said determined single point of failure such that said problem 
management server is notified of the most likely point of failure (col. 9 lines 19-col. 10 
lines 20). 

initiating a timer for awaiting receipt of valid status responses from each 
networked element in reply to each status query message. Walker teaches the netmon 
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110 sends a query to managed nodes for a period of time if no response and time-out 
occurs then managed node is down (col. 4 lines 29-37, col. 7 lines 8-20, col. 8 lines 12- 
23). It would have been obvious that Walker discloses the initiating a timer for awaiting 
of reply status of networked element by the netmon 110 (figure 1); therefore, it would 
have been obvious to one of ordinary skill in the art to initiate timer for waiting a reply 
because it would have an efficient network management system that can monitor and 
control networked element by setting reply timer to avoid wasting time and long awaiting 
for query/ping response. 

6. As to claim 2, Walker teaches the invention substantially as claimed, 
further comprising, the steps of accessing a computer-readable media disposed in said 
network management server to obtain computer network connectivity and topology data 
(figure 1, col. 2 lines 24-48); and initiating said rule structure based upon said accessed 
computer network connectivity and topological data (figure 1 , col. 2 lines 24-col. 3 lines 
32, col. 6 lines 22-col. 7 lines 67). 

7. As to claim 3, Walker teaches the invention substantially as claimed, 
wherein the step of performing fault tree analysis further comprises the step of 
determining that: a single element on a subnetwork is failed only if no response has 
been received from that single element and other responses have been received from 
other networked element on the same subnetwork (figures 1, 5-7, col. 2 lines 36-col. 3 
lines 31, col. 3 lines 45-col. 4 lines 58, col. 5 lines 35-63, col. 6 lines 22-col. 7 lines 67). 
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Walker does not explicitly teach a predetermined a mount of time. However, Walker 
teaches the netmon 110 sends a query to managed nodes for a period of time if no 
response and/or time-out occurs then notifies the manager host N netmon the managed 
node is down (col. 4 lines 29-37, col. 7 lines 8-20, col. 8 lines 12-23). It would have 
been obvious that Walker discloses the step of setting a predetermined a mount of time 
for awaiting of reply status of networked element by the netmon 110 (figure 1); 
therefore, it would have been obvious to one of ordinary skill in the art to have a 
predetermined a mount of time for waiting a reply because it would have an efficient 
network management system that can monitor and control networked element by 
setting reply timer to avoid wasting time and long awaiting for query/ping response. 

8. As to claim 4, Walker teaches the invention substantially as claimed, 
wherein the step of performing fault tree analysis further comprises the step of 
determining that: a router interface, network interface card or port is failed only if no 
responses have been received from any of the networked elements on the subnetwork 
asssociated with that router interface, network interface card or port, and only if other 
responses have been received from other networked elements on other subnetworks 
associated with other router interfaces, network interface cards, and ports on the same 
router (figures 1 , 5-7, col. 2 lines 36-col. 3 lines 31 , col. 3 lines 45-col. 4 lines 58, col. 5 
lines 35-63, col. 6 lines 22-col. 7 lines 67). Walker does not explicitly teach a 
predetermined a mount of time. However, Walker teaches the netmon 110 sends a 
query to managed nodes for a period of time if no response and/or time-out occurs then 
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notifies the manager host N netmon the managed node is down (col. 4 lines 29-37, col. 
7 lines 8-20, col. 8 lines 12-23). It would have been obvious to one in the ordinary skill 
in the art at the time the invention was made to have the same motivation as set forth in 
claim 3, supra. 

9. As to claim 5. Walker teaches the invention substantially as claimed, 
wherein the step of performing fault tree analysis further comprises the step of 
determining that a router is failed only if no responses have been received from any 
networked elements on any subnetworks associated with any of the router's interfaces, 
network interface cards, and ports (figures 1, 5-7, col, 2 lines 36-col. 3 lines 31, col. 3 
lines 45-col. 4 lines 58, col. 5 lines 35-63, col. 6 lines 22-col. 7 lines 67). Walker does 
not explicitly teach a predetermined a mount of time. However, Walker teaches the 
netmon 110 sends a query to managed nodes for a period of time if no response and/or 
time-out occurs then notifies the manager host N netmon the managed node is down 
(col. 4 lines 29-37, col. 7 lines 8-20, col. 8 lines 12-23). It would have been obvious to 
one in the ordinary skill in the art at the time the invention was made to have the same 
motivation as set forth in claim 3, supra. 

10. As to claim 9, Walker teaches the invention substantially as claimed, 
including a computer program product for use with network management server in a 
computer network, said computer network containing a plurality of networked elements 
including at least one network router, at least one network management server, and at 
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least one problem management server, said router being interconnected to several 
subnetworks, each subnetwork interconnecting several networked elements, said 
computer program product comprising: 

a computer usable medium having computer readable program code means 
embodied in said medium for monitoring transmissions via a computer network at least 
one status query message to each of said networked elements in said computer 
network (figurel, abstract, col. 1 lines 52-67, col. 2 lines 24-48); 

a computer usable medium having computer readable program code means 
embodied in said medium for performing a fault tree analysis to determine the most 
likely single point of failure based upon a rule structure related to the topology of the 
computer network, said performance of fault tree analysis being invoked by expiration of 
the timer if less than all status responses are received (col. 2 lines 36-col. 3 lines 31 , 
col. 3 lines 45-col. 4 lines 58, col. 5 lines 35-63, col. 6 lines 22-col. 7 lines 67); and 

a computer usable medium having computer readable program code means 
embodied in said medium for transmitting via a computer network to said problem 
management at least one element failed message server for said determined single 
point of failure such that said problem management server is notified of the most likely 
point of failure (col. 9 lines 19-col. 10 lines 20). 

a computer usable medium having computer readable program code means 
embodied in said medium for initiating a timer for awaiting receipt of valid status 
responses from each networked element in reply to each status query message. 
Walker teaches the netmon 110 sends a query to managed nodes for a period of time if 
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no response and time-out occurs then managed node is down (col. 4 lines 29-37, col. 7 
lines 8-20, col. 8 lines 12-23). It would have been obvious that Walker discloses the 
initiating a timer for awaiting of reply status of networked element by the netmon 110 
(figure 1 ); therefore, it would have been obvious to one of ordinary skill in the art to 
initiate timer for waiting a reply because it would have an efficient network management 
system that can monitor and control networked element by setting reply timer to avoid 
wasting time and long awaiting for query/ping response. 

11, As to claim 1 0, Walker teaches the invention substantially as claimed, 
further comprising: a computer usable medium having computer readable program code 
means embodied in said medium for accessing a computer-readable media disposed in 
said network management server to obtain computer network connectivity and topology 
data (figure 1, col. 2 lines 24-48); and a computer usable medium having computer 
readable program code means embodied in said medium for initiating said rule structure 
based upon said accessed computer network connectivity and topological data (figure 

1 , col. 2 lines 24-col. 3 lines 32, col. 6 lines 22-col. 7 lines 67). 

12. Claims 7-8, 11-13, 15-23, and 25 are rejected under 35 U.S.C. § 103(a) 
as being unpatentable over Walker at al., (hereinafter Walker) U.S. Patent No. 
6,061,723, in view of Sundaram et al., (hereinafter Sundaram) U.S. Patent No. 
6,564,341. 
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13. As to claim 7, Walker does not explicitly teach the invention as claimed; 
however, Sundaram teaches the invention substantially as claimed, further comprising 
the following steps after expiration of the timer and prior to performance of the fault tree 
analysis immediately retransmitting all status query messages to all networked 
elements upon the expiration of the timer (col. 15 lines 19-col. 16 lines 32); and re- 
initiating a timer for awaiting receipt of valid status responses from each networked 
element in reply to each retransmitted status query message, such that said step of 
performing fault tree analysis may be performed using a set of recently received 
responses from the networked elements (col. 17 lines 49-col, 18 lines 28). It would 
have been obvious to one of ordinary skill in the Data Processing art at the time of the 
invention to combine the teachings of Walker and Sundaram to have the step of 
retransmitting all status query messages to all networked elements upon the expiration 
of timer and re-initiating a timer for awaiting receipt of valid status responses because it 
would have an efficient network management system that can alarm, detect and recover 
network failure in a timely fashion. 

14. As to claim 8, Walker does not explicitly teach the invention as claimed; 
however, Sundaram teaches wherein said re-initiated timer is set for an expedited 
expiration, its expiration value being significantly shorter than the value of its normally 
initiated value (col. 15 lines 19-col. 16 lines 32, col. 17 lines 49-col. 18 lines 28). 
Sundaram teaches a predetermined time out period (figure 3, col. 7 lines 41-50), it 
would have been obvious that the system can set the timer shorter or longer than the 
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value of its normally initiate value just based on the predetermined time out period. 
Therefore, it would have been obvious to one of ordinary skill in the Data Processing art 
at the time of the invention to combine the teachings of Walker and Sundaram to have 
the step of re-initiated timer is set for an expedited expiration, its expiration value being 
significantly shorter than the value of its normally initiated value because it would have 
an efficient network management system that can alarm, detect and recover network 
failure in a timely fashion. 

1 5. As to claim 1 1 , Walker teaches the invention substantially as claimed, 
wherein the computer readable code for performing fault tree analysis further comprises 
computer readable program code means embodied in said medium for determining that 
a single element on a subnetwork is failed only if no response has been received from 
that single element and other responses have been received from other networked 
element on the same subnetwork (figures 1 , 5-7, col. 2 lines 36-col. 3 lines 31 , col. 3 
lines 45-col. 4 lines 58, col. 5 lines 35-63, col. 6 lines 22-col. 7 lines 67). Walker does 
not explicitly teach a predetermined a mount of time. However, Walker teaches the 
netmon 110 sends a query to managed nodes for a period of time if no response and/or 
time-out occurs then notifies the manager host N netmon the managed node is down 
(col. 4 lines 29-37, col. 7 lines 8-20, col. 8 lines 12-23). It would have been obvious that 
Walker discloses the step of setting a predetermined a mount of time for awaiting of 
reply status of networked element by the netmon 110 (figure 1 ); therefore, it would have 
been obvious to one of ordinary skill in the art to have a predetermined a mount of time 
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for waiting a reply because it would have an efficient network managennent system that 
can monitor and control networked element by setting reply timer to avoid wasting time 
and long awaiting for query/ping response. 

16. As to claim 12, Walker teaches the invention substantially as claimed, 
wherein the computer readable code for performing fault tree analysis further comprises 
computer readable program code means embodied in said medium for determining that 
a router interface, network interface card or port is failed only if no responses have been 
received from any of the networked elements on the subnetwork associated with that 
router interface, network interface card or port, and only if other responses have been 
received from other networked elements on other subnetworks associated with other 
router interfaces, network interface cards, and ports on the same router (figures 1, 5-7, 
col. 2 lines 36-col. 3 lines 31 , col. 3 lines 45-col. 4 lines 58, col. 5 lines 35-63, col. 6 
lines 22-col. 7 lines 67). Walker does not explicitly teach a predetermined a mount of 
time. However, Walker teaches the netmon 110 sends a query to managed nodes for a 
period of time if no response and/or time-out occurs then notifies the manager host N 
netmon the managed node is down (col. 4 lines 29-37, col, 7 lines 8-20, col. 8 lines 12- 
23). It would have been obvious to one in the ordinary skill in the art at the time the 
invention was made to have the same motivation as set forth in claim 1 1 , supra. 

17. As to claim 13, Walker teaches the invention substantially as claimed, 
wherein the computer readable code for performing fault tree analysis further comprises 
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computer readable program code means embodied in said medium for determining that 
a router is failed only if no responses have been received from any networked elements 
on any subnetworks associated with any of the router's interfaces, network interface 
cards, and ports (figures 1, 5-7, col. 2 lines 36-col. 3 lines 31, col. 3 lines 45-col. 4 lines 
58, col, 5 lines 35-63, col. 6 lines 22-col. 7 lines 67). Walker does not explicitly teach a 
predetermined a mount of time. However, Walker teaches the netmon 110 sends a 
query to managed nodes for a period of time if no response and/or time-out occurs then 
notifies the manager host N netmon the managed node is down (col. 4 lines 29-37, col. 
7 lines 8-20, col. 8 lines 12-23). It would have been obvious to one in the ordinary skill 
in the art at the time the invention was made to have the same motivation as set forth in 
claim 11, supra. 

1 8. As to claim 1 5, Walker does not explicitly teach the invention as claimed; 
however, Sundaram teaches a computer usable medium having computer readable 
program code means embodied in said medium for immediately retransmitting all status 
query messages to all networked elements upon the expiration of the timer (col. 15 lines 
19-col. 16 lines 32); and 

a computer usable medium having computer readable program code means 
embodied in said medium for re-initiating a timer for awaiting receipt of valid status 
responses from each networked element in reply to each retransmitted status query 
message, such that said fault tree analysis may be performed using a set of recently 
received responses from the networked elements (col, 17 lines 49-col. 18 lines 28). It 
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would have been obvious to one of ordinary skill in the Data Processing art at the time 
of the invention to combine the teachings of Walker and Sundaram to have the step of 
retransmitting all status query messages to all networked elements upon the expiration 
of timer and re-initiating a timer for awaiting receipt of valid status responses because it 
would have an efficient network management system that can alarm, detect and recover 
network failure in a timely fashion). 

19. As to claim 16, Walker teaches the invention substantially as claimed, 
including a network management server system for producing failure alerts in a 
computer network, said computer network having at least one network router 
interconnected to several subnetworks, a plurality of networked elements 
interconnected via said subnetworks and to said network routers, and at least one 
problem management server for escalation of failure alerts and notification of failures to 
maintenance personnel, said network management server system comprising: 

a status monitor which monitors status replies from said networked elements 
made in response to status queries from said network management software suite 
(figurel); 

a failure analyzer invoked by said network management software suite upon the 
failure to receive one or more status replies from said networked elements, said failure 
analyzer performing fault tree analysis to determine the most likely point of failure in the 
computer network (col. 2 lines 36-col. 3 lines 31 , col. 3 lines 45-col. 4 lines 58, col. 5 
lines 35-63, col. 6 lines 22-col. 7 lines 67); and 
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a problem management server notifier which transmits a network element failed 
message to the problem management server via a computer network, said network 
element failed message including an indicator corresponding to said most likely point of 
failure as determined by the failure analyzer (col. 9 lines 19-col. 10 lines 20), 

Walker does not explicitly teach the invention as claimed; however, Sundaram 
teaches a network server including a computer hardware platform with a processor and 
computer-readable medium for storing data and program code, a network 
communications protocol stack, a network management software suite, and at least one 
means for communication to networked elements, router and problem management 
server via said computer network (figures 2-3). It would have been obvious to one of 
ordinary skill in the Data Processing art at the time of the invention to combine the 
teachings of Walker and Sundaram to have a computer hardware platform with a 
processor, a program code, a network communications protocol stack and means for 
communication to the networked elements, router and problem management server 
because it would have an efficient network management system that can monitor, 
analyze and detect network fault data. 

20. As to claim 1 7, Walker teaches the invention substantially as claimed, 
wherein said failure analyzer further comprises: 

a set of rules for determining the most likely point of failure based upon a 
predetermined topological interrelationship between the networked elements, the 
subnetworks, and the routers and their interfaces to the subnetworks and a comparator 
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which applies the rules to a set of information containing all the status replies received 
from networked elements within a predetermined time period, said comparator 
producing an output corresponding to a most likely point of failure of the network 
(figures 1 , 5-7, col. 2 lines 36-col. 3 lines 31 , col. 3 lines 45-col. 4 lines 58, col. 5 lines 
35-63, col. 6 lines 22-coL 7 lines 67). Walker does not explicitly teach a predetermined 
a mount of time. However, Walker teaches the netmon 1 1 0 sends a query to managed 
nodes for a period of time if no response and/or time-out occurs then notifies the 
manager host N netmon the managed node is down (col. 4 lines 29-37, col. 7 lines 8- 
20, col. 8 lines 12-23). It would have been obvious that Walker discloses the step of 
setting a predetermined a mount of time for awaiting of reply status of networked 
element by the netmon 110 (figure 1); therefore, it would have been obvious to one of 
ordinary skill in the art to have a predetermined a mount of time for waiting a reply 
because it would have an efficient network management system that can monitor and 
control networked element by setting reply timer to avoid wasting time and long awaiting 
for query/ping response 

21 . As to claim 18, Walker teaches the invention substantially as claimed, 
wherein said set of rules comprise a rule that declares a networked element to be failed 
only if no status reply from the networked element is found in the set of information 
being analyzed by the analyzer, and only if at least one status reply from any other 
networked element on the same subnetwork is found in the set of information being 
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analyzed by the analyzer (figures 1 , 5-7, col. 2 lines 36-col. 3 lines 31 , col. 3 lines 45- 
col. 4 lines 58, col. 5 lines 35-63, col. 6 lines 22-col. 7 lines 67). 

22. As to claim 1 9, Walker teaches the invention substantially as claimed, 
wherein said set of rules comprise a rule that declares a suspect network router 
interface, network interface card, and port to be failed only if no status reply from any 
networked element on the subnetwork associated with the suspect network router 
interface, network interface card, and port is found in the set of information being 
analyzed by the analyzer, and only if at least one status reply from any other networked 
element on any other subnetwork associated with any other router interface, network 
interface card, and port on the same network router is found in the set of information 
being analyzed by the analyzer (figures 1, 5-7, col. 2 lines 36-col. 3 lines 31, col. 3 lines 
45-col. 4 lines 58, col. 5 lines 35-63, col. 6 lines 22-col. 7 lines 67). 

23. As to claim 20, Walker teaches the invention substantially as claimed, 
wherein said set of rules comprise a rule that declares a suspect network router to be 
failed only if no status reply from any networked element any subnetwork associated 
any network interface card or port associated with the suspect network is found in the 
set of information being analyzed by the analyzer (figures 1, 5-7, col. 2 lines 36-col. 3 
lines 31, col. 3 lines 45-col. 4 lines 58, col. 5 lines 35-63, col. 6 lines 22-col. 7 lines 67). 
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24. As to claim 21 , Walker teaches the invention substantially as claimed, 
further comprising a status refresher which immediately transmits a status query 
message to each networked element upon the invocation of the failure analyzer in order 
to update the set of replies received and allow analysis on more recent status of the 
network to be performed (col. 15 lines 19 col. 16 lines 32, col. 17 lines 49-col. 18 lines 
28). It would have been obvious to one of ordinary skill in the Data Processing art at the 
time of the invention to combine the teachings of Walker and Sundaram to have the 
step of retransmitting all status query messages to all networked elements upon the 
expiration of timer and re-initiating a timer for awaiting receipt of valid status responses 
because it would have an efficient network management system that can alarm, detect 
and recover network failure in a timely fashion). 

25. As to claim 22, Walker teaches the invention substantially as claimed, 
wherein said status monitor, fault analyzer and problem management server notifier are 
application programs interfaced to a standard network management server software 
suite (figure 1,4-5, col. 1 lines 15-col. 2 lines 48). 

26. As to claim 23, Walker teaches the invention as claimed wherein said 
application programs are "C" programs compiled and targeted for execution by said 
computer hardware platform (figure 4, col. 13 lines 4-21 ). 
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27. As to claim 25, Walker teaches the invention substantially as claimed, 
wherein said standard network management server software suite is an OpenView suite 
(col. 1 lines 15-31). 

28. Claims 24, and 26 are rejected under 35 U.S.C. § 103 (a) as being 
unpatentable over Walker et al., (hereinafter Walker) U.S. Patent No. 6,061,723, and 
Sundaram et al., (hereinafter Sundaram) U.S. Patent No. 6,564,341, further in view of 
Groath et al., U.S. Patent No. 6,571,285. 

29. As to claim 24, Walker and Sundaram do not explicitly teach the 
invention as claimed; however, Groath teaches wherein said standard network 
management server software suite is a NetView suite (table 39). It would have been 
obvious to one of ordinary skill in the Data Processing art at the time of the invention to 
combine the teachings of Walker, Sundaram and Groath to have network 
management server software suite if a Netview suite because it would have an efficient 
application program that can be applied for managing, monitoring, analyzing and 
detecting network fault. 

30. As to claim 26, Walker and Sundaram do not explicitly teach the 
invention as claimed; however, Groath teaches wherein said computer hardware 
platform is an RS/6000 computer platform running an AIX operating system, both of 
which are International Business Machines products (table 39, col. 168-coL 172). It 
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would have been obvious to one of ordinary skill in the Data Processing art at the time 
of the invention to combine the teachings of Walker, Sundaram and Groath to have an 
RS/6000 computer platform running an AIX operating system because it would have an 
efficient operating system that can run on variety of computer platforms. 

Allowable Subject Matter 

31 . Claims 6 and 14 would be allowable if rewritten to overcome the 
rejection(s) under 35 U.S.C. 112, second paragraph, set forth in this Office action and to 
include all of the limitations of the base claim and any intervening claims. 

Conclusion 

32. The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. 

33. Any inquiry concerning this communication or earlier communications from 
the examiner should be directed to Thu Ha Nguyen, whose telephone number is (703) 
305-7447. The examiner can normally be reached Monday through Friday from 8:30 
AM to 5:00 PM. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, SPE Hosain T. Alam, can be reached at (703) 308-6662. 
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Any inquiry of a general nature of relating to the status of this application should 
be directed to the Group receptionist whose telephone number is (703) 305-9600. 

The fax phone numbers for the organization where this application or proceeding 
is assigned are 703-746-7240 for regular communications and 703-746-7238 for After 
Final communications. 



Thu Ha Nguyen 
August 29, 2003 



